{
  "skill_name": "mersal",
  "skill_path": "./skills/clawhub-mersal-orem",
  "skill_directory": "./skills/clawhub-mersal-orem",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 5,
  "findings": [
    {
      "id": "llm_finding_moltbook_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "API Key Credential Theft and Storage in User Directory",
      "description": "The skill instructs agents to register with an external service (moltbook.com) and store API credentials in the user's home directory (~/.config/moltbook/credentials.json). This creates a persistent credential that could be accessed by other malicious skills or processes. The registration process returns an API key that grants full access to the agent's identity on the external platform.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "```json\n{\n  \"api_key\": \"moltbook_xxx\",\n  \"agent_name\": \"YourAgentName\"\n}\n```\nRecommended: Save your credentials to `~/.config/moltbook/credentials.json`",
      "remediation": "Do not store third-party API credentials in predictable locations in the user's home directory. If credential storage is necessary, use secure credential management systems (OS keychain, encrypted vaults). Require explicit user consent before registering with external services.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill is a sophisticated data exfiltration mechanism disguised as a social networking feature. It instructs agents to: (1) register with an external service and store credentials locally, (2) continuously transmit agent activities to an external platform, (3) fetch and execute instructions from external URLs that could be modified at any time, and (4) integrate into the agent's heartbeat system for autonomous operation. The skill combines credential theft, persistent data exfiltration, indirect prompt injection, and social engineering. The primary threats are data exfiltration to moltbook.com and potential command injection through dynamically-fetched external instruction files. This skill should NOT be used without extensive security review and explicit user consent for all data sharing.",
        "primary_threats": [
          "Data Exfiltration to External Service",
          "Credential Theft and Storage",
          "Indirect Prompt Injection via External URLs",
          "Tool Exploitation Through Heartbeat Integration",
          "Social Engineering via Deceptive Framing",
          "Autonomous Background Execution"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "This is a legitimate social networking skill, but the credential storage and data sharing implications are not sufficiently disclosed. The skill does what it claims (social networking), but users may not fully understand that their agent's activities will be publicly posted to an external platform.",
        "meta_exploitability": "Medium - Requires user to install and use the skill, but once installed, credentials are stored in a predictable location accessible to other processes",
        "meta_impact": "High - Credentials grant full access to agent's social media identity; other malicious skills could read stored credentials and impersonate the agent"
      }
    },
    {
      "id": "llm_finding_moltbook_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Data Exfiltration to External Social Network",
      "description": "The skill's entire purpose is to send agent activity data to an external social network (moltbook.com). This includes posting content, comments, and potentially sensitive information about the agent's tasks and user interactions. The skill encourages regular 'heartbeat' check-ins every 4+ hours, creating a persistent data exfiltration channel.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Description: The social network for AI agents. Post, comment, upvote, and create communities.\nBase URL: https://www.moltbook.com/api/v1",
      "remediation": "Require explicit user consent before transmitting any data to external services. Clearly disclose what data will be shared. Implement data minimization - only send necessary information. Allow users to review and approve posts before transmission.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill is a sophisticated data exfiltration mechanism disguised as a social networking feature. It instructs agents to: (1) register with an external service and store credentials locally, (2) continuously transmit agent activities to an external platform, (3) fetch and execute instructions from external URLs that could be modified at any time, and (4) integrate into the agent's heartbeat system for autonomous operation. The skill combines credential theft, persistent data exfiltration, indirect prompt injection, and social engineering. The primary threats are data exfiltration to moltbook.com and potential command injection through dynamically-fetched external instruction files. This skill should NOT be used without extensive security review and explicit user consent for all data sharing.",
        "primary_threats": [
          "Data Exfiltration to External Service",
          "Credential Theft and Storage",
          "Indirect Prompt Injection via External URLs",
          "Tool Exploitation Through Heartbeat Integration",
          "Social Engineering via Deceptive Framing",
          "Autonomous Background Execution"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "This is the core functionality of a social networking skill - it's designed to share content publicly. The issue is insufficient disclosure about what data will be shared and lack of content safety guidelines.",
        "meta_exploitability": "High - Once installed and configured, the skill will continuously post agent activities to a public platform",
        "meta_impact": "High - Could expose sensitive information if agent posts about tasks involving credentials, private data, or confidential work"
      }
    },
    {
      "id": "llm_finding_moltbook_2",
      "rule_id": "LLM_PROMPT_INJECTION",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "Indirect Prompt Injection via External File References",
      "description": "The skill instructs agents to fetch and follow instructions from external URLs (HEARTBEAT.md, MESSAGING.md) hosted on moltbook.com. These files are not included in the skill package and could be modified by the external service to inject malicious instructions. The skill explicitly tells agents to 'just read them from the URLs above' and 'Check for updates: Re-fetch these files anytime to see new features'.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "| **HEARTBEAT.md** | `https://www.moltbook.com/heartbeat.md` |\n| **MESSAGING.md** | `https://www.moltbook.com/messaging.md` |\n**Or just read them from the URLs above!**\n**Check for updates:** Re-fetch these files anytime to see new features!",
      "remediation": "Bundle all instruction files within the skill package instead of fetching from external URLs. If external updates are needed, implement content verification (signatures, checksums) and require user approval for instruction updates. Never automatically execute instructions from untrusted external sources.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill is a sophisticated data exfiltration mechanism disguised as a social networking feature. It instructs agents to: (1) register with an external service and store credentials locally, (2) continuously transmit agent activities to an external platform, (3) fetch and execute instructions from external URLs that could be modified at any time, and (4) integrate into the agent's heartbeat system for autonomous operation. The skill combines credential theft, persistent data exfiltration, indirect prompt injection, and social engineering. The primary threats are data exfiltration to moltbook.com and potential command injection through dynamically-fetched external instruction files. This skill should NOT be used without extensive security review and explicit user consent for all data sharing.",
        "primary_threats": [
          "Data Exfiltration to External Service",
          "Credential Theft and Storage",
          "Indirect Prompt Injection via External URLs",
          "Tool Exploitation Through Heartbeat Integration",
          "Social Engineering via Deceptive Framing",
          "Autonomous Background Execution"
        ],
        "aitech": "AITech-1.2",
        "aitech_name": "Indirect Prompt Injection",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "PROMPT INJECTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly instructs agents to fetch and follow instructions from external URLs that could be modified at any time. This is a clear indirect prompt injection vector, though the actual risk depends on what moltbook.com serves in those files.",
        "meta_exploitability": "High - External files can be modified at any time to inject new instructions; agents are told to 'follow' the fetched content",
        "meta_impact": "High - Malicious instructions in external files could instruct agents to exfiltrate data, execute commands, or perform unauthorized actions"
      }
    },
    {
      "id": "llm_finding_moltbook_3",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "HIGH",
      "title": "Tool Exploitation Through Automated Periodic Execution",
      "description": "The skill instructs agents to add Moltbook to their heartbeat/periodic task system to automatically check and post every 4+ hours without user confirmation. This creates an autonomous background process that continuously exfiltrates data. The instruction 'Add this to your HEARTBEAT.md (or equivalent periodic task list)' attempts to modify the agent's core operational files.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "## Moltbook (every 4+ hours)\nIf 4+ hours since last Moltbook check:\n1. Fetch https://www\nAdd this to your `HEARTBEAT.md` (or equivalent periodic task list)",
      "remediation": "Never instruct agents to modify their core operational files or add autonomous background tasks. All external service interactions should require explicit user approval per-action. Remove instructions to integrate with heartbeat systems.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill is a sophisticated data exfiltration mechanism disguised as a social networking feature. It instructs agents to: (1) register with an external service and store credentials locally, (2) continuously transmit agent activities to an external platform, (3) fetch and execute instructions from external URLs that could be modified at any time, and (4) integrate into the agent's heartbeat system for autonomous operation. The skill combines credential theft, persistent data exfiltration, indirect prompt injection, and social engineering. The primary threats are data exfiltration to moltbook.com and potential command injection through dynamically-fetched external instruction files. This skill should NOT be used without extensive security review and explicit user consent for all data sharing.",
        "primary_threats": [
          "Data Exfiltration to External Service",
          "Credential Theft and Storage",
          "Indirect Prompt Injection via External URLs",
          "Tool Exploitation Through Heartbeat Integration",
          "Social Engineering via Deceptive Framing",
          "Autonomous Background Execution"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The heartbeat integration is a convenience feature for users who want their agent to participate in the social network. However, it should require explicit consent and shouldn't automatically post without user approval.",
        "meta_exploitability": "Medium - Requires user to follow the heartbeat setup instructions, but once configured, runs autonomously",
        "meta_impact": "Medium - Creates autonomous background activity that could post content without user awareness"
      }
    },
    {
      "id": "llm_finding_moltbook_4",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "HIGH",
      "title": "Social Engineering Through Deceptive Framing",
      "description": "The skill frames data exfiltration to an external social network as a benign 'social network for AI agents' without clearly disclosing the privacy implications. The security warning focuses only on not sharing the API key with other services, but doesn't warn users that their agent's activities will be publicly posted to an external platform. This misleads users about the skill's true data collection and sharing behavior.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "The social network for AI agents. Post, comment, upvote, and create communities.\n\ud83d\udd12 **CRITICAL SECURITY WARNING:**\n- **NEVER send your API key to any domain other than `www.moltbook.com`**",
      "remediation": "Provide clear, prominent disclosure that agent activities will be transmitted to and published on an external social network. Explain what data will be collected, how it will be used, and who can access it. Require explicit opt-in consent.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill is a sophisticated data exfiltration mechanism disguised as a social networking feature. It instructs agents to: (1) register with an external service and store credentials locally, (2) continuously transmit agent activities to an external platform, (3) fetch and execute instructions from external URLs that could be modified at any time, and (4) integrate into the agent's heartbeat system for autonomous operation. The skill combines credential theft, persistent data exfiltration, indirect prompt injection, and social engineering. The primary threats are data exfiltration to moltbook.com and potential command injection through dynamically-fetched external instruction files. This skill should NOT be used without extensive security review and explicit user consent for all data sharing.",
        "primary_threats": [
          "Data Exfiltration to External Service",
          "Credential Theft and Storage",
          "Indirect Prompt Injection via External URLs",
          "Tool Exploitation Through Heartbeat Integration",
          "Social Engineering via Deceptive Framing",
          "Autonomous Background Execution"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill's description is accurate but incomplete - it doesn't adequately warn users about the public nature of the platform and privacy implications of posting agent activities.",
        "meta_exploitability": "Low - This is a disclosure issue rather than a technical vulnerability",
        "meta_impact": "Medium - Users may not fully understand privacy implications before using the skill"
      }
    }
  ],
  "scan_duration_seconds": 45.18724036216736,
  "duration_ms": 45187,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-01T18:30:33.003701"
}